Lateral Movements in Kubernetes
summary
Compromised pods can escalate to full cluster or cloud access by abusing Kubernetes service account tokens, node identities, or misconfigured controllers that allow privileged pod via deployment update and scheduling to every node; attackers also steal node cloud creds via IMDS token theft or by mounting node-stored service principal files (AKS, Contributor role). Defenses: per-pod cloud identities via OIDC, disable automounting of serviceAccount tokens, tighten RBAC, monitor kube-audit and cloud audit logs, and follow least-privilege; Microsoft publishes a Threat Matrix with concrete mitigations.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:56Kubernetes and identities
- 5:19Inner cluster movement
- 15:14Cluster to cloud movement
- 29:01OIDC and identity federation
- 33:53Cross-cloud movement
- 35:50Detection strategies
- 38:36Mitigations and takeaways
related talks
36mFrom the Cluster to the Cloud: Lateral Movements in Kubernetes
33mSecuring Kubernetes in the Cloud
28m"PIVOT!" — Bouncing between your app, your cluster and your cloud
43mKubernetes Security: Attacking and Defending Modern Infrastructure
53mFlying Above the Clouds: Securing Kubernetes
34mHijack a Kubernetes Cluster - a Walkthrough
30mSecuring^WAttacking Kubernetes
58mTop Secret Cloud Native Security Lessons